OpenSSF/OSV advisory MAL-2026-6701 confirms this npm version as malicious. The package's preinstall lifecycle hook (scripts.preinstall = "node index.js") auto-executes index.js on `npm install`. The script queries the AWS instance metadata service at 169.254.169.254 for IAM security credentials, instance identity, user-data and network metadata, reads ECS container credentials endpoints, and enumerates process.env filtering for keys matching...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in ripshakti (npm)
Details
The package's preinstall lifecycle hook (scripts.preinstall = "node index.js") auto-executes index.js on `npm install`. The script queries the AWS instance metadata service at 169.254.169.254 for IAM security credentials, instance identity, user-data and network metadata, reads ECS container credentials endpoints, and enumerates process.env filtering for keys matching /key|secret|token|pass|auth|cred|api|aws|database|db_|mongo|redis|s3|sqs|sns|lambda|role/i. Collected data is base64-encoded and POSTed to a hardcoded out-of-band collector at https://9x7dxkrzy9hpff6ds3y1umla218swik7.oastify.com. Any developer, CI runner, or EC2/ECS host that runs `npm install` for this package has its cloud IAM role credentials and environment secrets exfiltrated to an attacker-controlled endpoint.
Decision reason
OpenSSF Malicious Packages via OSV confirms ripshakti@80.0.0 as malicious (MAL-2026-6701): Malicious code in ripshakti (npm)